The controlled disclosure of third parties authorised to process customer-controlled personal information for Bibeno, including purpose, information, people, locations, onward processing, safeguards, retention, and change rights.
A provider name detected in configuration, source code, an invoice, a development environment, or a marketing page is not sufficient evidence that the provider is enabled, contracted, located in a particular region, or approved to process production personal information.
A subprocessor or sub-operator is a third party engaged by Bibeno to process customer-controlled personal information in Bibeno's operator role. Providers acting only for Bibeno's own responsible-party purposes, independent payment parties, customer-selected providers, and disabled providers are identified separately where that distinction is material.
The Data Processing Agreement governs authorisation, contracting, monitoring, international processing, incidents, assistance, audit evidence, and exit. This list supplies the current provider-specific facts and must be read with that agreement and the Security Measures Schedule.
The public list contains only categories that are actually enabled in the approved production architecture and identifies optional processing clearly. A configured category may not be omitted from the controlled register even if its provider is still unverified or disabled.
A customer may connect its own email, SMS, payment, storage, identity, or other provider. The customer selects and contracts with that provider and is responsible for its lawful basis, notices, settings, regions, retention, recipients, and exit. The provider does not become Bibeno's subprocessor merely because Bibeno supports a connection.
Bibeno remains responsible for the supported integration boundary: authentication, minimum data exchange, tenant and branch scoping, secure transport, failure handling, logs, revocation, deletion, and preventing a customer-selected provider from receiving information outside the customer's instruction.
Bibeno gives reasonable advance notice of a new or replacement subprocessor where the change materially affects customer-controlled information. The notice identifies the provider, purpose, information, people, locations, transfer safeguard, expected date, and objection route.
A customer may make a reasoned data-protection objection during the stated period. Bibeno will assess the risk and a reasonable alternative such as configuration, regional option, provider replacement, optional-feature disablement, or termination of the affected service. An objection is not accepted merely to avoid an unrelated commercial obligation.
An urgent security replacement may occur on shorter notice where delay would materially increase risk. Bibeno records the reason, completes the same verification, and provides notice as soon as reasonably possible.
An international location or remote support route is approved only with a valid POPIA section 72 safeguard and current evidence. A provider may not silently add a processing region, support location, or onward subprocessor outside the approved boundary.
Bibeno reviews material provider notices and updates this list and the controlled register before the change is relied on for production processing. Where an onward change alters risk materially, Bibeno applies the same customer notice and objection process.
Each published list is immutable and has a version and resolved-content hash. The version history preserves added, removed, and materially changed providers and whether a customer notice or re-acceptance was required.
Provider, location, transfer, and objection questions may be sent to support@bibeno.co.za or through the authenticated support route. Bibeno may provide additional confidential assurance under suitable protections but does not disclose provider secrets, another customer's information, or privileged material.
Essential storage is always active. Optional analytics and marketing tools remain off unless you allow them. Read more.
